Search icon CANCEL
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Conferences
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Data Analytics Using Splunk 9.x

You're reading from   Data Analytics Using Splunk 9.x A practical guide to implementing Splunk's features for performing data analysis at scale

Arrow left icon
Product type Paperback
Published in Jan 2023
Publisher Packt
ISBN-13 9781803249414
Length 336 pages
Edition 1st Edition
Tools
Arrow right icon
Author (1):
Arrow left icon
Dr. Nadine Shillingford Dr. Nadine Shillingford
Author Profile Icon Dr. Nadine Shillingford
Dr. Nadine Shillingford
Arrow right icon
View More author details
Toc

Table of Contents (18) Chapters Close

Preface 1. Part 1: Getting Started with Splunk
2. Chapter 1: Introduction to Splunk and its Core Components FREE CHAPTER 3. Chapter 2: Setting Up the Splunk Environment 4. Chapter 3: Onboarding and Normalizing Data 5. Part 2: Visualizing Data with Splunk
6. Chapter 4: Introduction to SPL 7. Chapter 5: Reporting Commands, Lookups, and Macros 8. Chapter 6: Creating Tables and Charts Using SPL 9. Chapter 7: Creating Dynamic Dashboards 10. Part 3: Advanced Topics in Splunk
11. Chapter 8: Licensing, Indexing, and Buckets 12. Chapter 9: Clustering and Advanced Administration 13. Chapter 10: Data Models, Acceleration, and Other Ways to Improve Performance 14. Chapter 11: Multisite Splunk Deployments and Federated Search 15. Chapter 12: Container Management 16. Index 17. Other Books You May Enjoy

Exploring Splunk queues

The Splunk data pipeline is a series of processes that converts incoming data into Splunk events. These processes include breaking data into events, defining the timestamp, and extracting fields. We will use a set of keywords throughout this section, including pipeline, processor, and queue. A pipeline is a Splunk thread. There can be multiple pipelines running at the same time. There may be multiple processors/processes within a pipeline. The queue is the data structure that stores data between pipelines. Data coming into Splunk is queued before it can be processed. If a process takes longer than usual, the queues fill up. In this section, we will discuss the different segments of the Splunk data pipeline. Figure 8.8 shows the relationship between queues, processors, and pipelines:

Figure 8.8 – Queues, pipelines, and processors

Figure 8.8 – Queues, pipelines, and processors

The Splunk data pipeline consists of four main segments:

  • Parsing
  • Merging
  • Typing...
lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at €18.99/month. Cancel anytime